Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
Fraudulent Job offer: jcexport.biz
- Job offer spam: Forwarding payments (Fraud)
- jcexport.biz (created 2004-11-29)
- jtexport.biz (created 2004-12-17)
- jtexport.org (created 2004-12-27)
- Fraudulent job offers: alpenantique.com
- Fraudulent job offers: lionder.org
- Forwarding Paypal payments via Western Union (Fraud)
Scam domain jcexport.biz (created 2004-11-29)
See more about this type of scam here:
Here are the message headers:
Notes:
This is a similar scam to the "Plasma project, Inc.", "Alpen-Antique GmbH", Lionder.org and "AIC" job scams.
As we recently found out, the objective of the "Alpen-Antique GmbH" fraud was to trick people into making money stolen from hacked bank accounts untraceable by receiving it in their own account, withdrawing it in cash and then forwarding it via Western Union. Most likely, "JC Export" will steal money from hacked US bank accounts in the near future and is looking for people to unwittingly assist them. Quite possibly organized crime from Eastern Europe is behind this scam: Lionder.org posed as a Lithuanian company, "Alpen-Antique GmbH" supplied an Estonian name for the wire transfer recipient and "AIC" claims to run billboards in Russia.
As with the "Plasma project, Inc." and "Alpen-Antique GmbH" scams, the fraudulent website is based on the site of a legitimate company. In these scams the fraudulent website keeps getting recycled under new names. We expect jcexport.biz to resurface under a new name.
Compare the original:
with this rip-off:
ANA Export Company
Orchidbeautiful.com / Umina Brothers Inc.
The "JC EXPORT" job offer is part of a series of scams designed to trick third parties into assisting the criminal laundering of stolen money. It has many similarities to the alpenantiqe.com and a-i-c-d.org frauds.
Hello Michael,
Unfortunately all the mail assistant position vacancies are filled by now, but
we are now looking for a few people in USA for long term home based part time Monetary Asistant
position which would require higher level of responsibility but will also be more rewarding (at least $450 weekly),
and I thought that you and/or anybody who you know or your friends know who needs a good part time job and who fits
these requirements might be interested in taking this position -
- Resident of the USA (from any state)
- Is at least 21 years old
- Very responsible and dependable
- Have computer with internet at home or at work
- Have 1 hour free during the business hours
if you are interested in the position then please let me know,
if this is somebodyelse who is interested in the position then that person needs to apply on our website
at http://www.jcexport.biz/employment.html
Below is a description of the position:
The necessity of having this position for our company comes from the fact that
we are a Europe-based (Holland) an have the major part of a profit coming from
the other
countries's market, and in order to lower our high taxes here in Europe (every
company is required
to pay it's taxes only in the country where it is registered and based), we,
like many
other import-export companies use special marketing system the bottom line of
which is
to divide the whole coming money stream into numerous smaller money streams;
and in order to do this we need many bank accounts which those smaller money
streams would go through and people who would control them. This is a pure
marketing, it doesn't break any law of any country in any way.
You would need to:
- have one or more bank account(s) in any major US bank(s) (small country banks
are
not good), can be newly opened or not
- report everyday bank activity related to the company (although of course I
would be notifying you in advance every time any money transaction occurs)
- 2 to 4 times a week to do money transfers following the instruction I
would be giving you
The bottom line is:
- some company's money will be going to your account(s) every 1-2 days and you
will be responsible for transfering it to the company
- the monthly total amount going through one account would be $20.000 - $25.000
- company will be covering all possible bank's fees
- the salary for this position per one bank account you can provide the company
with is $450 in cash weekly paid every week by direct deposit starting the day
when the account's first bank transaction occurs
- you can work with up to 3 accounts
Thank you.
David
Project Manager
JC EXPORT
NL-4670 AA Dinteloord
Markwegzuid 2a
NL-4794 SN Heijningen
Tel.: +31 - 167 - 523910
Fax: +31 - 167 - 523218
Received: from [200.162.115.199] (helo=200.162.115.199)
by #####.##########.### with smtp (Exim 4.43)
id 1CZxwd-0006MN-Jx; Thu, 02 Dec 2004 21:52:56 +0100
Message-ID: <0645435799.6ZTLBH7ud@antronomia.com>
Received: from 92.180.30.80 by t947-d57.x4.antronomia.com with DAV;
Thu, 02 Dec 2004 15:39:12 -0600
Reply-To: "JC EXPORT, Jayson Rollins" <Angel@nctta.org>
From: "JC EXPORT, Jayson Rollins" <Angel@nctta.org>
To: <recipientemailaddr>
Subject: Re: your ad
Date: Thu, 02 Dec 2004 19:43:12 -0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--2121040298303784"
Founded in Bakersfield, California in 1997, ANA Export Company has rapidly become one of the leading wholesale suppliers of premium orchids, fresh fruits, and organic pomegranate concentrate throughout North America and Asia. Today, ANA has a worldwide team of growers, packers, shippers, and employees committed to consistently providing the highest quality products at the most competitive prices.
Founded in Deventer, Holland in 1997, JC Export Company has rapidly become one of the leading wholesale suppliers of premium orchids, fresh fruits, and organic pomegranate concentrate throughout Europe and Asia. Today, JC has a worldwide team of growers, packers, shippers, and employees committed to consistently providing the highest quality products at the most competitive prices.
Is ANA Export Company a legitimate original company whose website was ripped off or is it a previous incarnation of the fraud? We would like to know. When we called ANA Export Company's phone number, we only got recorded message, no live switchboard. An email we sent to their main email address bounced because the mailbox was full. The online order page of the site says "SOLD OUT" for all items listed (see http://www.anaexport.com/wst_page4.html). A phone directory lookup for "ANA EXport Company" in Bakersfield, CA found no matches. There are however a number of links to the site at horticultural sites. Archive.org holds some copies of their site from September and November 2003 and another one from 2004-02-08, but no changes after that.
Umina Brothers Inc. is a real produce business. The "Produce" link at Orchidbeautiful.com leads to the Umina.com website, all other links lead to Orchidbeautiful.com. Probably Orchidbeautiful.com was built using bits of the genuine Umina.com website.
Just like our customers, we at ANA have high standards. All of our products are cultivated, shipped, and distributed in order to ensure maximum quality and freshness.
http://www.anaexport.com/wst_page2.html
Just like our customers, we at Umina Bros. have high standards. All of our products are cultivated, shipped, and distributed in order to ensure maximum quality and freshness.http://www.orchidbeautiful.com/about%20umina.htm
Just like our customers, we at AU have high standards. All of our products are cultivated, shipped, and distribute in order to ensure maximum quality and providing superior product at a competitive price delivered promptly at your door.http://www.auinternational.com/managementvisions.htm
Network of sending IP address 200.162.115.199:
inetnum: 200.162.115.192/27
aut-num: AS15180
abuse-c: GMC9
owner: Galvani Indústria, Comércio e Serviços Ltda
ownerid: 000.546.997/0001-80
responsible: Juliano Sanches
address: Av. Prof.Benedicto Montenegro, 1300, Betel
address: 13140-000 - Paulinia - SP
phone: (019) 3884-3900 [3993]
owner-c: GIS85
tech-c: GIS85
created: 20031028
changed: 20031028
inetnum-up: 200.162.0/17
nic-hdl-br: GIS85
person: Galvani Industria, Comercio e Servicos
e-mail: jsanches@GALVANI.IND.BR
address: Av.Prof.Benedicto Montenegro, 1300, Betel
address: 13140-000 - Paulinia - SP
phone: (019) 3884-9300 [9397]
created: 20001120
changed: 20020514
nic-hdl-br: GMC9
person: Gustavo Mendes de Carvalho
e-mail: gcarvalho@DIVEO.NET.BR
address: Rua Tenente Negrao, 166, 1. andar
address: 04530-030 - Sao Paulo - SP
phone: (11) 30482500 [2561]
created: 19981005
changed: 20040329
remarks: Security issues should also be addressed to
remarks: nbso@nic.br, http://www.nbso.nic.br/
remarks: Mail abuse issues should also be addressed to
remarks: mail-abuse@nic.br
% whois.registro.br accepts only direct match queries.
% Types of queries are: domains (.BR), BR POCs, CIDR blocks,
% IP and AS numbers.
WHOIS record for jcexport.biz
The "jcexport.biz" scam appears to have been revived using a new domain, "jtexport.biz". We came across the following spam on an list archive dating from January 2005. This spam uses exactly the same subject line as the earlier "jcexport.biz" job offer scam:
We received the following report about it (early February 2005):
We doubt this will be the last scam following this scheme.
WHOIS details for jtexport.biz
The scam continues: jtexport.org (created 2004-12-27)
Here is an email from the criminals:
WHOIS details for jtexport.org
Anti-Spam Resources:
Clueless virus filters spam innocent third parties
Domain Name: JCEXPORT.BIZ
Domain ID: D8323371-BIZ
Sponsoring Registrar: NETWORK SOLUTIONS INC.
Sponsoring Registrar IANA ID: 2
Domain Status: clientTransferProhibited
Registrant ID: 38752551
Registrant Name: Milton Lopez
Registrant Address1: 277 Summer Street
Registrant City: PASSAIC
Registrant State/Province: NJ
Registrant Postal Code: 07055
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.9732499954
Registrant Email: dhoffman_jcexport@yahoo.com
Administrative Contact ID: 38752551
Administrative Contact Name: Milton Lopez
Administrative Contact Address1: 277 Summer Street
Administrative Contact City: PASSAIC
Administrative Contact State/Province: NJ
Administrative Contact Postal Code: 07055
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.9732499954
Administrative Contact Email: dhoffman_jcexport@yahoo.com
Billing Contact ID: 450287
Billing Contact Name: Invoice Processing System
Billing Contact Organization: Invoice Processing System
Billing Contact Address1: 3250 West Commercial Blvd #200
Billing Contact City: Ft. Lauderdale
Billing Contact State/Province: FL
Billing Contact Postal Code: 33309
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Email: netsolnotify@affinity.com
Technical Contact ID: 5362153
Technical Contact Name: ValueWeb
Technical Contact Organization: ValueWeb
Technical Contact Address1: 3250 west commercial Blvd.
Technical Contact Address2: **
Technical Contact City: Ft Lauderdale
Technical Contact State/Province: FL
Technical Contact Postal Code: 33309
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.9543348000
Technical Contact Facsimile Number: +1.9543348001
Technical Contact Email: hostmaster@VALUEWEB.NET
Name Server: DNS1.VALUEWEB.COM
Name Server: DNS2.VALUEWEB.COM
Name Server: DNS3.VALUEWEB.COM
Created by Registrar: NETWORK SOLUTIONS INC.
Last Updated by Registrar: NETWORK SOLUTIONS INC.
Domain Registration Date: Mon Nov 29 21:01:11 GMT 2004
Domain Expiration Date: Tue Nov 28 23:59:59 GMT 2006
Domain Last Updated Date: Mon Nov 29 21:01:19 GMT 2004
From: David Hoffman <hr@jtexport.biz>
Subject: Re: your ad
I just wanted to write and thank you and update you
about a money laundering scam I found out about on
your website. I saw a job advertised on a website
looking for people to doing mailing for a company
called JT Export. I applied and was 'accepted' for
the job. They told me that they would send me
envelopes and postage and all I had to do was print
out a letter they emailed me and send it out to
everyone on the mailing list they also sent me. They
said they would deposit $250 in my account every week
and asked for my bank account information. I was
suspicious from the start, but they had a website that
looked legitimate. Well, it got more suspicious when
they claimed they mailed me 500 envelopes and other
supplies that never arrived. When I emailed them
about this, they did not reply. Then today I went to
check their website again, it was gone! By searching
on the internet, I managed to find your webpage -
www.joewein.de/sw/fraud-jcexport-biz.htm
which described this company that I was dealing with
exactly - except they changed from JC Export to JT
Export.
Request: jtexport.biz
Domain Name: JTEXPORT.BIZ
Domain ID: D8493739-BIZ
Sponsoring Registrar: TLDS INC.
Sponsoring Registrar IANA ID: 320
Domain Status: clientTransferProhibited
Registrant ID: 5581430-SRSPLUS
Registrant Name: David Tsai
Registrant Organization: TsaiCo
Registrant Address1: 330 San Miguel
Registrant City: Arcadia
Registrant State/Province: CA
Registrant Postal Code: 91007
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.5218518834
Registrant Email: admin@web2mail.com
Administrative Contact ID: 5581431-SRSPLUS
Administrative Contact Name: David Tsai
Administrative Contact Organization: TsaiCo
Administrative Contact Address1: 330 San Miguel
Administrative Contact City: Arcadia
Administrative Contact State/Province: CA
Administrative Contact Postal Code: 91007
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.5218518834
Administrative Contact Email: admin@web2mail.com
Billing Contact ID: 5581431-SRSPLUS
Billing Contact Name: David Tsai
Billing Contact Organization: TsaiCo
Billing Contact Address1: 330 San Miguel
Billing Contact City: Arcadia
Billing Contact State/Province: CA
Billing Contact Postal Code: 91007
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.5218518834
Billing Contact Email: admin@web2mail.com
Technical Contact ID: 5581432-SRSPLUS
Technical Contact Name: David Tsai
Technical Contact Organization: TsaiCo
Technical Contact Address1: 330 San Miguel
Technical Contact City: Arcadia
Technical Contact State/Province: CA
Technical Contact Postal Code: 91007
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.5218518834
Technical Contact Email: admin@web2mail.com
Name Server: NS1.VHOSTED.BIZ
Name Server: NS2.VHOSTED.BIZ
Created by Registrar: TLDS INC.
Last Updated by Registrar: TLDS INC.
Domain Registration Date: Fri Dec 17 02:45:21 GMT 2004
Domain Expiration Date: Fri Dec 16 23:59:59 GMT 2005
Domain Last Updated Date: Fri Dec 17 03:06:04 GMT 2004
This was basically a re-run of jtexport.biz but using a slightly different domain that had been registered 10 days later. This one uses an address in Kazakhstan, Central Asia, a former soviet republic.
Dear friend,
Thank you for your interest in the Mail Assistant position in our
company.
Please find more info regarding the position below.
Position requirements:
Only dependable and responsible people need to apply.
- computer connected to the internet
- any standart printer
- USA resident
- Adult people only
- 2 hours a day to contribute
Job description:
Person who will be accepted for this job will follow these
instructions:
1. Receive the correspondence for our company to his/her USA
residential address;
2. Report to our manager by email(every candidate will be included in
manager's lists).
3. Fill the forms and papers if it is needed.
4. Sort the documents in the way it is needed.
5. Stuff the envelopes if it is nedeed.
5. Ship it out. (All the postages are prepaid by the company)
(you will be receiving an e-mail with detailed instruction for every
peace of mail)
There would be only envelopes with documents only, NO packages.
There would be 60-80 envelopes received by you every week.
You would be expected to work about 2 hours a day.
All postages ARE prepaid by the company, NONE of the money would come
from your pocket.
You would be paid every week on Monday in the exact amount of $250 by
direct deposit to your bank account.
If you are still interested in the position please fill out the form on
our website at http://www.jtexport.org/employment.html
Our manager will contact you soon with a confirmation letter if
approved.
We are an export company based in Holland. More info about the company
at our website (under repair till Jan 14th but you can still fill out
the app.)
Thank you,
Michael Edenets
Project manager
JT Export
NL-4670 AA Dinteloord
Markwegzuid 2a
Heijningen
(31167)523910
Domain ID:D105485440-LROR
Domain Name:JTEXPORT.ORG
Created On:27-Dec-2004 05:28:28 UTC
Last Updated On:28-Jan-2005 12:49:14 UTC
Expiration Date:27-Dec-2005 05:28:28 UTC
Sponsoring Registrar:OnlineNIC Inc. (R64-LROR)
Status:TRANSFER PROHIBITED
Registrant ID:ONLC-1491521-4
Registrant Name:Dmitriy Davydenko
Registrant Organization:Dmitriy Davydenko
Registrant Street1:mik-on 6-4-39
Registrant Street2:mik-on 6-4-39
Registrant Street3:
Registrant City:Karaganda
Registrant State/Province:KZ
Registrant Postal Code:470032
Registrant Country:KZ
Registrant Phone:+7.3003770611
Registrant Phone Ext.:1111
Registrant FAX:+7.3003770611
Registrant FAX Ext.:
Registrant Email:dweb@dweb.ru
Admin ID:ONLC-1491521-1
Admin Name:Dmitriy Davydenko
Admin Organization:Dmitriy Davydenko
Admin Street1:mik-on 6-4-39
Admin Street2:mik-on 6-4-39
Admin Street3:
Admin City:Karaganda
Admin State/Province:KZ
Admin Postal Code:470032
Admin Country:KZ
Admin Phone:+7.3003770611
Admin Phone Ext.:1111
Admin FAX:+7.3003770611
Admin FAX Ext.:
Admin Email:dweb@dweb.ru
Tech ID:ONLC-1491521-2
Tech Name:Dmitriy Davydenko
Tech Organization:Dmitriy Davydenko
Tech Street1:mik-on 6-4-39
Tech Street2:mik-on 6-4-39
Tech Street3:
Tech City:Karaganda
Tech State/Province:KZ
Tech Postal Code:470032
Tech Country:KZ
Tech Phone:+7.3003770611
Tech Phone Ext.:1111
Tech FAX:+7.3003770611
Tech FAX Ext.:
Tech Email:dweb@dweb.ru
Name Server:NS1.MASTERHOST.RU
Name Server:NS2.DNS-DIY.COM
Name Server:NS1.DNS-DIY.COM
Name Server:NS1.DJEMBO.COM
Name Server:
jwSpamSpy is our spam filter (free evaluation version available for download)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
IP address ranges
Dynamic IP addresses (700 KB!)
Name server / Registrar combinations
Free email providers
AOL dial-up address ranges and mail servers
How to trace senders of spam
Frequently asked questions (FAQ)
Lookup an IP address on blacklists (http://dnsbl.net.au/lookup/)
Challenge and Response spam filters: A selfish idea for selfish times
ShareYourExperiences.com spammers
Smyrnagroup spammers (in German)
Kaplan College spam
Stock Price Manipulation Spam ("Pump & Dump")
What's the deal with "OEM software"?
'Phishing' for your wallet
Job spam for payment processors
Spam phone numbers ("diploma" spam, etc.)
"Joe job" information
Link exchange offer spam
Getting creative with spam
Link exchange spam: allcarpictures.com
Xenophobia, Spam and Viruses: The "German Spam" (Sober.H)
Sober.H – Racist German email spam spread by virus (in German)
"Joe job" against joewein.de
Porn spam: watchsound.com
Porn spam: hotsalza.com
Name servers used by spammers: joker.com
Rogue name servers: mediadreamland.com
Rogue name servers: airmaramba.biz
Rogue name servers: bonafidecash.com
Rogue name servers: maileasy.biz